Legacy Application Access Control Through Intermediary Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Legacy applications tightly coupled with their authentication mechanisms require significant rewriting to adapt to new identity infrastructures, leading to resource-intensive and costly modernization efforts.

Innovation Solution

A system that routes authentication requests through an intermediary, generating temporary user credentials without altering the application's internal authentication process, allowing compatibility with modern identity providers while preserving the application's existing interactions with end-users.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If the application is rewritten to be compatible with new identity infrastructure, then compatibility with modern authentication mechanisms is improved, but development time and resources increase

Engineering Contradiction:

Improvecompatibility with modern identity infrastructureVSAvoiddevelopment time

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

An intermediary component is introduced between the legacy application and the new identity infrastructure. This intermediary translates authentication requests from the legacy application's expected format into formats compatible with modern identity providers, enabling compatibility without rewriting the application itself.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The authentication system is segmented into distinct layers: the legacy application layer that remains unchanged, an intermediary translation layer that handles format conversion, and the modern identity infrastructure layer. This segmentation allows each layer to evolve independently.

Inventive Principle:

Principle #1Segmentation

2Adaptability or versatility

If the application is rewritten to be compatible with new identity infrastructure, then compatibility with modern authentication mechanisms is improved, but resource consumption increases

Engineering Contradiction:

Improvecompatibility with modern identity infrastructureVSAvoidcomputational resources

Core Design Contradiction:

Adaptability or versatilityVSUse of energy by moving object

Solution Approach 1:

The intermediary acts as a translation buffer that converts authentication protocols without requiring resource-intensive rewriting of the entire application. This approach consumes fewer computational resources compared to full application reconstruction.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

Instead of modifying the original application, a copying approach is used where the intermediary creates a virtual representation of the authentication interface that translates between legacy and modern formats, preserving the original application's resource efficiency.

Inventive Principle:

Principle #26Copying

3Speed

If direct authentication requests are made from the application to the identity store, then authentication speed is improved, but the application becomes tightly coupled with the identity infrastructure

Engineering Contradiction:

Improveauthentication speedVSAvoidcoupling between application and identity infrastructure

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The intermediary is positioned between the application and identity store to decouple their direct connection. It maintains authentication speed by efficiently translating requests while preventing tight coupling, as the application interacts with the intermediary through standardized interfaces rather than directly with the identity infrastructure.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The authentication flow is segmented into distinct components: application, intermediary, and identity store. This segmentation reduces coupling by defining clear boundaries and interfaces between components, allowing them to be modified independently while maintaining overall system functionality.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12375485B2Systems, methods, and storage media for controlling user access to an application

Publication Date: 2025.07.29 STRATA IDENTITY INC

AI summary

A system for controlling user access to an application is disclosed, where the system is configured to receive a request to access the application from a user, the application associated with an identity provider and a datastore; route the request to an intermediary; redirect the request to an identity provider for authentication; authenticate a user with the application based on receiving application identity information at the identity provider; generate a temporary user credential at the intermediary; provide the request along with the temporary user credential to the application; capture a backchannel request from the application to the datastore; confirm that the temporary user credential matches the one previously generated; send confirmation to the application that the temporary user credential enables user access to the application; send communication from the application to the user granting the user access to the application.